Audit Trail

The Audit Trail gives you complete visibility into everything that happens inside your account. Every login, setting change, and API request is logged, giving you a full, tamper-evident record for security reviews, compliance checks, and incident investigation.

Only a Merchant Admin can access the Audit Trail.

Step 1: Open the Audit Trail

Click Settings at the bottom of the left sidebar.
Select the Audit Trail tab from the top navigation bar.

The dashboard displays a chronological list of all account activity, including the timestamp, acting admin, HTTP method, endpoint accessed, and request status.

Step 2: Search and Filter Logs

Use the filters at the top of the dashboard to narrow down entries:

Filter	How to Use
Search bar	Search by keyword, endpoint, or action description
Admin email	Filter to see all actions performed by a specific team member
IP address	Track activity originating from a specific device or network location
Date range	Set a Start date and End date to isolate a specific time window
HTTP method	Filter by action type: view, create, update, or delete

For security investigations, combine Admin email with a Date range to reconstruct exactly what a specific team member did during a given period.

Step 3: Understand HTTP Methods

Every log entry includes a Method that describes the type of action performed:

Method	Action Type	What It Means
`GET`	View / Read	The user viewed information - checking a balance, loading a list, or opening a record
`POST`	Create	The user added something new - creating a payment, inviting an admin, or generating an API key
`PUT`	Update / Replace	The user replaced an existing setting or record entirely
`PATCH`	Modify	The user made a targeted edit to part of an existing record or setting
`DELETE`	Remove	The user deleted a record, API key, or team member from the system

DELETE and PUT actions are the highest-risk entries in your audit log. Review these immediately if you notice unexpected changes to settings, team members, or API keys.

Step 4: View Detailed Log Entries

To inspect the full details of any specific action:

Click the eye icon in the Actions column next to the log entry.
The Audit log details side panel opens.

Request Summary

Field	Description
Method badge	The HTTP method used (e.g., `GET`, `POST`, `DELETE`)
Endpoint	The full API path accessed
Duration	How long the request took to complete, in milliseconds
IP Address	The network address the request originated from
Timestamp	The exact date and time the action occurred
User Agent	The browser and operating system used

Response Body

The Response body tab shows the raw API response returned for that request. This is the most detailed view available for any logged action.

{
  "data": [
    {
      "recipient": "+2609***000",
      "event": "payment.received",
      "status": "DELIVERED",
      "messagePreview": "You received ZMW 250 from 0960000001. Ref: DEP-abc123-001. Balance: ZMW 1,250.",
      "providerRef": "MTN-ZM-00123456"
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 20,
    "total": 4,
    "totalPages": 1
  }
}

A providerRef of null means the message was rejected before it reached the mobile network. Verify the recipient’s contact details in Admins or Cashiers.

Location

Switch to the Location tab to see the geographic and network origin of the action:

Field	Description
City	The city associated with the request’s IP address
Country	The country the request originated from
ISP	The Internet Service Provider linked to that IP address

If you see a City, Country, or ISP that doesn’t match your team’s known locations, treat it as a potential security incident. Review the admin’s account, reset their password, and consider deactivating the account while you investigate.

Security Investigation Reference

What You See	What to Do
`DELETE` action on an admin or API key you didn’t authorise	Check User Info for the acting admin and reset their credentials immediately
`POST` to a payments endpoint at an unusual time	Cross-reference with Location to verify the request came from a known device
Multiple `GET` requests from an unfamiliar IP	Check ISP and City - could indicate credential sharing or a compromised session
`providerRef: null` on critical alerts	Verify the recipient’s phone number is correct in their profile
Actions from an admin who has left the business	Deactivate their account immediately via Settings → Admins

Sub Wallets

Team Members and Access Controls

Fees and Charges

Payments

Product Store

Point of Sale (POS)

SMS Logs

Audit Logs

Payouts & Transfers

Payment Links

Invoices

USSD Payments

Help and Support

Step 1: Open the Audit Trail

Step 2: Search and Filter Logs

Step 3: Understand HTTP Methods

Step 4: View Detailed Log Entries

Request Summary

Response Body

Location

Security Investigation Reference

Next Steps

SMS Logs

Team Members

​Step 1: Open the Audit Trail

​Step 2: Search and Filter Logs

​Step 3: Understand HTTP Methods

​Step 4: View Detailed Log Entries

​Request Summary

​Response Body

​Location

​Security Investigation Reference

​Next Steps

SMS Logs

Team Members

Step 1: Open the Audit Trail

Step 2: Search and Filter Logs

Step 3: Understand HTTP Methods

Step 4: View Detailed Log Entries

Request Summary

Response Body

Location

Security Investigation Reference

Next Steps